liuzhuohua
b7ca9c89e8
v1.0.10 两件大事：
1. 界面中英双语（英文界面无中文残留）
- 新增 web/i18n.js（约 4200 条词条），零依赖零构建
- 后端下发中文数据走 bt4() 查表翻译；独立模块（upstream/netdetail/
realtime/update）纳入翻译并注册切语言重绘钩子
- 后端「状态/聚合」接口只回稳定枚举+原始数值，不下发中文文案
- 顺带修一个真实 XSS：顶层 const 不挂 window，独立脚本 esc 静默退化成零转义
2. 修掉「文字竖着排/错位」（多分辨率反复暴露）
- 单元格 min-content 只有 1 字宽 → word-break:keep-all + 表头 nowrap
- 依赖卡片正文被标签/按钮挤成 27px → .dep-body{flex:1 1 200px} + flex-wrap
- 裸 flex:1（下限为0）给正文 → 一律改 flex:1 1 <px>
- .dep-item 横向容器直接塞块级子项 → 退回块级
- 关键陷阱：auto-fill 布局屏越宽列数越多单卡越窄，窄屏反而测不出来，
真机审计推进到「逐视图点按钮 + 1920/2560 宽视口 + 中英双语」
- 守卫 t-layout.py 扩到 35 条，12 处反向验证全红
3. 修真缺陷：_link_since() 重启检测被误改成 if False:（注释还写着「已修」），
uptime 归零后相减得负数 → 恢复比对 boot_id
附带：新增 25 个检查器（t-*.py）、排版审计工具链（shot-*/ocr-*/live-*）、
版本号兜底值同步到 1.0.10、.gitignore 收纳 i18n/排版排查的一次性脚本。
726 lines
83 KiB
Python
726 lines
83 KiB
Python
# -*- coding: utf-8 -*-
|
||
"""后端下发文案表的**英文对照**（64 张表 / 561 个条目）。
|
||
|
||
为什么需要：这些表（DDNS 服务商、QoS 档位、清理项、告警规则、向导步骤…）
|
||
定义在 `backend/drouter-helper.py` 的模块级常量里，随 API 下发给前端。
|
||
它们**全都有稳定 key**，所以前端可以用 `bt(表名, key, 字段)` 查表拿到英文 ——
|
||
后端一个字节都不用改。
|
||
|
||
为什么不走「后端按 X-Lang 下发英文」：那要动 30 张表的结构（每条加 `_en` 字段）
|
||
+ 改所有下发点，而且 JSON 体积翻倍。用前端查表，**后端零改动**。
|
||
|
||
数据来源：`_dev/_backend-tables.json`（由 ast 从真源码抽的，不是手抄）。
|
||
由 `_dev/apply-bt-en.py` 渲染进 `web/i18n.js` 的 `bt` 分组。
|
||
"""
|
||
|
||
# {表名: {key: {中文字段: 英文}}}
|
||
TABLES = {
|
||
'ACCEL_HW_NOTE': {
|
||
'当前网卡未报告支持硬件卸载，将使用软件快速路径（对家用场景已足够）。': {'en': 'No interface reported hardware-offload support; the software fast path will be used (sufficient for home use).'},
|
||
},
|
||
'ACCEL_IMPACT': {
|
||
'IPv6 转发': {'name': 'IPv6 forwarding', 'why': 'The current acceleration table takes over established IPv4/IPv6 connections alike; normal forwarding is unaffected.'},
|
||
'NAT / 端口映射': {'name': 'NAT / port forwarding', 'why': 'Existing NAT rules can stay; connection setup still goes through the full conntrack path. Test your port forwards once after enabling this.'},
|
||
'QoS / 流量整形 / 限速': {'name': 'QoS / traffic shaping / rate limiting', 'why': 'tc rate limiting works poorly together with the flowtable fast path, and limits may stop applying. Do not enable it while relying on rate limits, or keep the rate-limited traffic out of the fast path.'},
|
||
'UPnP 自动端口映射': {'name': 'UPnP automatic port mapping', 'why': 'UPnP still fires when new connections are set up and is unaffected; just re-check it once if you use long-lived mappings.'},
|
||
'复杂 ACL / 深度包检测': {'name': 'Complex ACL / deep packet inspection', 'why': 'Content-based rules (domain or keyword filtering) only apply to new connections; later packets of a long connection are no longer inspected.'},
|
||
'策略路由 / 多出口分流': {'name': 'Policy routing / multi-WAN split', 'why': 'Complex splitting that depends on per-packet marking needs reviewing too; exclude the affected traffic from flowtable if necessary.'},
|
||
'连接跟踪统计 / 流量监控': {'name': 'Connection tracking statistics / traffic monitoring', 'why': 'conntrack still records connections, but byte counts for offloaded traffic may stop updating, so monitoring graphs will drift.'},
|
||
'逐包防火墙日志 / 计数': {'name': 'Per-packet firewall logging / counting', 'why': 'Established connections no longer traverse the forward chain per packet, so log / counter rules for those packets stop matching. If you need to audit every connection precisely, leave this off.'},
|
||
},
|
||
'ACCEL_SCOPE': {
|
||
'IPv4 + IPv6（双栈同时加速）': {'en': 'IPv4 + IPv6 (dual-stack acceleration)'},
|
||
'仅 IPv4': {'en': 'IPv4 only'},
|
||
'仅 IPv6': {'en': 'IPv6 only'},
|
||
'未覆盖任何协议族': {'en': 'No address family covered'},
|
||
},
|
||
'ACCEL_SCOPE_NOTE': {
|
||
'ICMP / ICMPv6 等不属于"连接型"流量，默认不卸载，仍逐包经过防火墙（便于排障与限速）。': {'en': 'ICMP / ICMPv6 are not "connection-oriented" traffic and are not offloaded by default; they still traverse the firewall per-packet (for troubleshooting and rate limiting).'},
|
||
'IPv4 与 IPv6 是两套独立的规则：只写 ip 则仅 IPv4 被加速，IPv6 仍逐包走 netfilter。': {'en': 'IPv4 and IPv6 are two independent rule sets: writing only ip accelerates IPv4 alone, while IPv6 still traverses netfilter per-packet.'},
|
||
'IPv6 的下一个头字段是 nexthdr（不是 protocol）；使用扩展头的报文会在内核里被规范化后再匹配。': {'en': 'IPv6 next-header field is nexthdr (not protocol); packets using extension headers are normalized by the kernel before matching.'},
|
||
'TCP / UDP / SCTP 等已建立连接 → 走快速路径': {'en': 'Established TCP / UDP / SCTP connections -> fast path'},
|
||
'TCP / UDP 已建立连接 → 走快速路径': {'en': 'Established TCP / UDP connections -> fast path'},
|
||
'flowtable 本身属于 inet 家族，可以同时承载 IPv4 与 IPv6；但「哪些连接的后续报文会被卸载到快速路径」取决于 forward 链里显式写下的匹配规则。Drouter 默认同时对 IPv4 和 IPv6 卸载已建立连接，你也可以只选其中一个协议族。': {'en': 'The flowtable belongs to the inet family and can carry both IPv4 and IPv6; however, which connections subsequent packets are offloaded to the fast path depends on the match rules explicitly written in the forward chain. Drouter offloads established connections for both IPv4 and IPv6 by default; you can also choose a single address family.'},
|
||
'已卸载的连接不再逐包经过 forward 链，因此针对这些包的日志 / 计数 / DSCP 标记会失效。': {'en': 'Offloaded connections no longer traverse the forward chain per-packet, so logging / counting / DSCP marking for those packets will stop working.'},
|
||
'若你的运营商不支持 IPv6，选择「仅 IPv4」可减少一条规则，几乎无差别。': {'en': 'If your ISP does not support IPv6, choosing "IPv4 only" removes one rule with almost no difference.'},
|
||
'软加速对 IPv4 与 IPv6 的作用范围': {'en': 'How software acceleration applies to IPv4 and IPv6'},
|
||
},
|
||
'ACL_ACTIONS': {
|
||
'allow': {'n': 'Allow (only these)', 'why': 'Whitelist mode: only these are permitted and everything else is blocked within the time group.'},
|
||
'block': {'n': 'Block (deny access)', 'why': 'Matching traffic is dropped outright; the most common action.'},
|
||
'limit': {'n': 'Rate limit (hand over to QoS)', 'why': 'No marking and no priority change; it just matches the QoS rate-limit rules.'},
|
||
'log': {'n': 'Log only (do not block)', 'why': 'Only produces log entries for observation; ideal for a trial run before you decide.'},
|
||
},
|
||
'ACL_APP_GROUPS': {
|
||
'ad': {'name': 'Ads & tracking', 'why': 'Ad and tracking domains; blocking them makes browsing feel noticeably better.'},
|
||
'adult': {'name': 'Adult content', 'why': 'Needs nDPI categories or an external blacklist; recommend blocking it always.'},
|
||
'custom': {'name': 'Custom (domain / IP)', 'why': 'Enter domains or IPs directly; useful for school sites, specific servers and the like.'},
|
||
'game': {'name': 'Games', 'why': 'Online game protocols (including Steam / Xbox / PSN platform traffic).'},
|
||
'p2p': {'name': 'P2P downloads', 'why': 'BT / P2P traffic, often blocked outright to protect the experience of other devices.'},
|
||
'social': {'name': 'Social & entertainment', 'why': 'Major short-video and social platforms — the category parents most often restrict.'},
|
||
'study': {'name': 'Study & work', 'why': 'Usually kept in the whitelist as an "allow" category.'},
|
||
'video': {'name': 'Video streaming', 'why': 'Long-form video platforms; heavy on bandwidth and a common target for time limits.'},
|
||
},
|
||
'ACL_GROUP_TEMPLATES': {
|
||
'guests': {'name': 'Guest devices', 'why': 'Devices on the guest network; usually allowed internet but blocked from the LAN.'},
|
||
'iot': {'name': 'IoT devices', 'why': 'Cameras, robot vacuums and the like; forbid them from initiating outbound connections and limit what they can reach.'},
|
||
'kids': {'name': 'Children\'s devices', 'why': 'Group a child\'s phone / tablet / study laptop together and apply time limits to them uniformly.'},
|
||
'work': {'name': 'Work devices', 'why': 'Office PCs; give them bandwidth priority and allow work collaboration apps.'},
|
||
},
|
||
'ACL_TIME_PRESETS': {
|
||
'always': {'name': 'Always in effect', 'why': 'No time limit; the rule applies all the time (useful for a permanent blacklist).'},
|
||
'homework': {'name': 'Homework hours', 'why': 'Weekday evenings; only study apps and essential sites are allowed.'},
|
||
'night': {'name': 'Night-time sleep', 'why': 'Every day 22:00 to 06:30 the next day, crossing midnight; used to cut the internet at night or leave only a whitelist.'},
|
||
'school': {'name': 'School day hours', 'why': 'Monday to Friday 07:00-17:00, used to limit entertainment apps during school hours.'},
|
||
'weekend': {'name': 'Weekends', 'why': 'All day Saturday and Sunday; usually relaxed.'},
|
||
},
|
||
'ALERT_CHANNELS': {
|
||
'bark': {'d': 'Enter the Bark server address and device key; tapping the title opens the URL. Self-hosted servers are supported.', 'n': 'Bark (iOS / Android push)'},
|
||
'smtp': {'d': 'Good for a work mailbox. Use a dedicated authorisation code as the password, not the main account password.', 'n': 'Email (SMTP)'},
|
||
'webhook': {'d': 'Paste the bot URL directly; the message format is chosen automatically per platform.', 'n': 'Group bot webhook (DingTalk / WeCom / Lark)'},
|
||
},
|
||
'ALERT_RULES': {
|
||
'backup_fail': {'n': 'Automatic backup failing repeatedly', 'unit': 'x', 'why': 'One backup failure may just mean the disk happened to be full; repeated failures mean the configuration itself is wrong.'},
|
||
'disk_full': {'n': 'Disk usage too high', 'unit': '%', 'why': 'Logs, snapshots and backups all write to the root partition. Above 90% both apt upgrades and database writes can fail, so the default warning fires at 85%.'},
|
||
'load_high': {'n': 'Load consistently high', 'unit': '', 'why': 'On a 2-core machine a sustained load above 3 means something is busy. Short spikes are normal, so this is info-level only, not a fault.'},
|
||
'loss_high': {'n': 'Heavy packet loss to the gateway', 'unit': '%', 'why': 'High ping loss usually means a cable, a port negotiation or Wi-Fi signal problem. It shows up as "pages loading half the time", which is harder to diagnose than a full outage.'},
|
||
'mem_high': {'n': 'Memory usage too high', 'unit': '%', 'why': 'With only 4 GB, running out of free memory takes down dnsmasq and the web panel first — and then you cannot open the interface to read the alert.'},
|
||
'snapshot_fail': {'n': 'Automatic snapshot failing repeatedly', 'unit': 'x', 'why': 'Snapshots are your "undo if I break it" safety net. If they quietly fail for two weeks, you find out on the day you need them that you cannot go back.'},
|
||
'temp_high': {'n': 'CPU temperature too high', 'unit': '°C', 'why': 'Small x86 boxes cool poorly; above 80 °C it is time to check the fan and dust in the case. If no temperature sensor can be read this rule is skipped automatically, so it will not fire falsely.'},
|
||
'wan_down': {'n': 'Internet link down', 'unit': 's', 'why': 'The link is only declared down after the gateway has stopped responding for this long. Too short a window and a single hiccup (a neighbour’s Wi-Fi, say) gets reported as an outage — and once the messages pile up nobody reads them.'},
|
||
},
|
||
'AUDIT_ACTIONS': {
|
||
'PPPoE 控制': {'n': 'PPPoE control'},
|
||
'主题之家': {'n': 'Themes'},
|
||
'保存配置': {'n': 'Save config'},
|
||
'修改快照备注': {'n': 'Edit snapshot note'},
|
||
'停止 VPN': {'n': 'Stop VPN'},
|
||
'创建快照': {'n': 'Create snapshot'},
|
||
'删除快照': {'n': 'Delete snapshot'},
|
||
'导出配置备份': {'n': 'Export config backup'},
|
||
'应用 VPN 配置': {'n': 'Apply VPN config'},
|
||
'应用配置': {'n': 'Apply config'},
|
||
'快照保护': {'n': 'Snapshot protection'},
|
||
'清理快照': {'n': 'Clean snapshots'},
|
||
'清理配置备份': {'n': 'Clean config backups'},
|
||
'登录失败': {'n': 'Login failed'},
|
||
'登录成功': {'n': 'Login success'},
|
||
'租约转静态': {'n': 'Lease -> static'},
|
||
'紧急救援通道': {'n': 'Rescue channel'},
|
||
'诊断工具': {'n': 'Diagnostics'},
|
||
},
|
||
'AUD_THEMES': {
|
||
'Drouter 经典蓝': {'en': 'Drouter Classic Blue'},
|
||
'暖阳': {'en': 'Warm Sun'},
|
||
'暗夜墨绿': {'en': 'Dark Green'},
|
||
'暗夜绯红': {'en': 'Dark Rose'},
|
||
'电光蓝': {'en': 'Electric Blue'},
|
||
'紫罗兰': {'en': 'Violet'},
|
||
'藏青色': {'en': 'Navy'},
|
||
'青竹': {'en': 'Teal'},
|
||
},
|
||
'BACKUP_ITEMS': {
|
||
'CA 证书库与私钥、WireGuard 私钥': {'en': 'CA certificate store and private keys, WireGuard private keys'},
|
||
'DHCP 与 DNS（drouter.conf）': {'en': 'DHCP and DNS (drouter.conf)'},
|
||
'Docker Compose 栈文件与引擎配置（daemon.json）': {'en': 'Docker Compose stacks and engine configuration (daemon.json)'},
|
||
'IPv4 / IPv6 防火墙规则集（nftables）': {'en': 'IPv4 / IPv6 firewall rulesets (nftables)'},
|
||
'IPv6 地址池、RA 通告、DHCPv6 前缀委派': {'en': 'IPv6 address pools, RA announcements, DHCPv6 prefix delegation'},
|
||
'NTP 时间同步、内核转发与 BBR 参数': {'en': 'NTP time sync, kernel forwarding and BBR parameters'},
|
||
'PPPoE 宽带账号密码、DHCP 静态绑定 MAC': {'en': 'PPPoE broadband credentials, DHCP static binding MACs'},
|
||
'PPPoE 拨号配置（不含账号密码）': {'en': 'PPPoE dial-up configuration (credentials excluded)'},
|
||
'全部模块的设置值（drouter.db 的 settings / ifaces / admins）': {'en': 'Settings of all modules (settings / ifaces / admins in drouter.db)'},
|
||
'当前主题、自定义主题文件': {'en': 'Active theme and custom theme files'},
|
||
'文件共享 Samba 配置、CUPS 打印配置': {'en': 'Samba file sharing and CUPS printing configuration'},
|
||
'智能限速 QoS 规则、应用识别 DPI 前缀库': {'en': 'Smart QoS rules and the DPI application prefix database'},
|
||
'端口转发与 DMZ、UPnP 配置': {'en': 'Port forwarding, DMZ and UPnP configuration'},
|
||
'网卡与桥接、LAN / WAN 口参数': {'en': 'NICs and bridges, LAN / WAN port parameters'},
|
||
'网卡备注与角色绑定': {'en': 'NIC notes and role bindings'},
|
||
'访问控制与家长时间组': {'en': 'Access control and parental time groups'},
|
||
},
|
||
'BACKUP_SCOPE': {
|
||
'外观与个性化': {'group': 'Appearance and personalisation'},
|
||
'敏感文件（需显式勾选才导出）': {'group': 'Sensitive files (only exported when explicitly ticked)'},
|
||
'服务与应用': {'group': 'Services and applications'},
|
||
'界面配置（数据库）': {'group': 'Interface configuration (database)'},
|
||
'网络与防火墙配置': {'group': 'Network and firewall configuration'},
|
||
},
|
||
'CA_KEY_TYPES': {
|
||
'ec:prime256v1': {'en': 'EC P-256 (faster and lighter; old devices may not support it)'},
|
||
'rsa:2048': {'en': 'RSA 2048 (best compatibility, recommended)'},
|
||
'rsa:4096': {'en': 'RSA 4096 (slower; signing and handshake cost more)'},
|
||
},
|
||
'CLEAN_ITEMS': {
|
||
'apt': {'name': 'APT package cache', 'risk': 'Reinstalling the same package afterwards means downloading it again. On an offline machine (or with a dead mirror) turn this one off.', 'why': 'Downloaded .deb files and package indexes left over from installs and upgrades. Nobody looks at them afterwards — the safest and most common dead weight here.'},
|
||
'core': {'name': 'Crash dumps (coredump)', 'risk': 'Only needed when diagnosing a crash; deleting ones older than the configured age does not affect operation.', 'why': 'Memory images the kernel dumps when a program crashes; a single one is often tens or hundreds of MB, and one crash can leave several.'},
|
||
'drouter_log': {'name': 'Panel runtime logs (old)', 'risk': 'Same: the live log is not deleted, and the entry above already excludes ulog* so nothing is double counted.', 'why': 'Operation and status logs from the panel’s modules, rotated daily by logrotate.'},
|
||
'journal': {'name': 'systemd journal', 'risk': 'Reclaimed with the official journalctl commands, which will not damage the journal file being written. History older than the configured age is discarded.', 'why': 'Standard output from every systemd service plus kernel logs. With no size limit it can reach hundreds of MB over a few months.'},
|
||
'snapdl': {'name': 'Snapshot download leftovers', 'risk': 'Only .tar.gz files are deleted; the snapshots themselves under /opt/drouter/snapshots are untouched.', 'why': 'Archives generated when you download a config snapshot from the panel; useless once downloaded.'},
|
||
'tmp': {'name': 'Temporary files (/tmp, /var/tmp)', 'risk': 'Only files untouched for 3 days are removed; temporary files in use are always fresh, so they are safe. systemd private directories and desktop runtime directories are excluded.', 'why': 'Debris left by crashes and interrupted installs. Debian does not clean /tmp automatically by default.'},
|
||
'trash': {'name': 'File manager trash', 'risk': 'In effect this gives the trash a shelf life; only items older than the configured age are cleared.', 'why': 'Files deleted under "Web Terminal / Files" are moved here so you can undo — but it never shrinks on its own.'},
|
||
'ulog': {'name': 'Firewall flow logs (old)', 'risk': 'Only rotated old files are deleted; the live ulog.jsonl is left alone, so no current records are lost.', 'why': 'Records every connection passing through the firewall. This is the fastest-growing file in the system — even before this host takes over routing it can write 1 MB a day, and much more afterwards.'},
|
||
'varlog': {'name': 'Rotated system logs', 'risk': 'Excludes /var/log/drouter (the panel log is managed separately) and the journal directory (reclaimed by systemd itself), avoiding double cleanup and half-deleted state.', 'why': 'Compressed archives rotated out of rsyslog / cups / apt and friends. Once you have looked inside once they have little value.'},
|
||
},
|
||
# ⚠️ 表名 = 后端常量名。历史上这两张表的名字互相错位（2026-10-09 理顺）：
|
||
# DPI 的 GitHub 代理（helper DPI_HOSTS，dict）曾被写成 DCFG_MIRRORS，
|
||
# Docker 镜像源（helper DCFG_MIRRORS，list）曾被写成 DOCKER_MIRRORS。
|
||
'DPI_HOSTS': {
|
||
'direct': {'name': 'Direct (no proxy)', 'why': 'No proxy at all. Pick this when you are outside China or already run your own proxy.'},
|
||
'gh-proxy': {'name': 'gh-proxy.com', 'why': 'A backup accelerator supporting both release files and raw files.'},
|
||
'ghfast': {'name': 'ghfast.top', 'why': 'One of the more active accelerator nodes right now.'},
|
||
'ghproxy': {'name': 'ghproxy.com', 'why': 'A long-standing public accelerator: fairly stable but occasionally rate-limited.'},
|
||
'ghproxy-net': {'name': 'ghproxy.net', 'why': 'Backup node; a good try when the others time out.'},
|
||
'gitclone': {'name': 'gitclone.com', 'why': 'Mirror-style proxy for the whole site, good for git clone (note the URL is assembled differently).'},
|
||
'moeyy': {'name': 'moeyy.cn', 'why': 'Supports both raw and archive downloads; decent speeds.'},
|
||
},
|
||
'DDNS_CUSTOM': {
|
||
'填入服务商给出的更新 URL，支持占位符 {ip} {ipv6} {domain} {token} {user} {pass}': {'d': 'Paste the update URL your provider gives you. Placeholders: {ip} {ipv6} {domain} {token} {user} {pass}.'},
|
||
'按服务商文档填写；适用于任何提供 HTTP 更新的服务商': {'d': 'Fill this in per your provider’s documentation; it works with any provider offering an HTTP update endpoint.'},
|
||
'自定义（URL 模板）': {'n': 'Custom (URL template)'},
|
||
},
|
||
'DDNS_PROVIDERS': {
|
||
'aliyun': {'desc': 'AccessKey signature (HMAC-SHA1) calling the Alidns OpenAPI; supports both IPv4 and IPv6 records', 'n': 'Alibaba Cloud DNS', 'region': 'China'},
|
||
'cloudflare': {'desc': 'API token + zone ID; supports A / AAAA records and works on the free plan', 'n': 'Cloudflare', 'region': 'International'},
|
||
'custom': {'desc': 'Enter the update URL your provider gives you; supports the placeholders {ip} {ipv6} {domain} {token} {user} {pass}', 'doc': 'Fill this in per the provider documentation; works with any service that offers HTTP updates', 'n': 'Custom (URL template)', 'region': 'Any'},
|
||
'dnspod': {'desc': 'Uses a DNSPod token (ID,Token) to call Record.Ddns; the most widely used at Chinese homes', 'n': 'DNSPod (Tencent Cloud)', 'region': 'China'},
|
||
'dnspod_tencent': {'desc': 'Tencent Cloud API 3.0 signature (TC3-HMAC-SHA256); suits existing Tencent Cloud accounts', 'n': 'Tencent Cloud DNSPod (SecretId/Key)', 'region': 'China'},
|
||
'duckdns': {'desc': 'Free; a token plus a domain, with a very simple update endpoint', 'n': 'Duck DNS', 'region': 'International'},
|
||
'dyndns': {'desc': 'The standard dyndns2 protocol, compatible with many routers and third-party services', 'n': 'DynDNS', 'region': 'International'},
|
||
'dynv6': {'desc': 'Free; native support for IPv6 (AAAA) as well as IPv4, updated with a token', 'n': 'dynv6', 'region': 'International'},
|
||
'freedns': {'desc': 'Free; uses an automatically generated update hash', 'n': 'FreeDNS', 'region': 'International'},
|
||
'godaddy': {'desc': 'GoDaddy API key + secret; updates A / AAAA records', 'n': 'GoDaddy', 'region': 'International'},
|
||
'googledomains': {'desc': 'Credentials for the old Google Domains dynamic DNS, now served by Squarespace', 'n': 'Google Domains (now Squarespace)', 'region': 'International'},
|
||
'he': {'desc': 'Free; uses a DDNS key and is IPv6 friendly', 'n': 'Hurricane Electric', 'region': 'International'},
|
||
'huaweicloud': {'desc': 'Huawei Cloud IAM + DNS API (AK/SK signature); supports dual-stack record sets', 'n': 'Huawei Cloud DNS', 'region': 'China'},
|
||
'namecheap': {'desc': 'Dynamic DNS password plus hostname', 'n': 'Namecheap', 'region': 'International'},
|
||
'noip': {'desc': 'The classic HTTP Basic update endpoint at dynupdate.no-ip.com', 'n': 'No-IP', 'region': 'International'},
|
||
'ovh': {'desc': 'OVH API (three-key AK/AS/CK signature)', 'n': 'OVH', 'region': 'International'},
|
||
'porkbun': {'desc': 'API key + secret key; updates A / AAAA records', 'n': 'Porkbun', 'region': 'International'},
|
||
},
|
||
'DDNS_REGION': {
|
||
'国内': {'en': 'Domestic'},
|
||
'国际': {'en': 'International'},
|
||
'通用': {'en': 'Generic'},
|
||
},
|
||
'DEP_GROUPS': {
|
||
'ac': {'n': 'Wireless AC / AP'},
|
||
'container': {'n': 'Containers'},
|
||
'core': {'n': 'Core runtime'},
|
||
'desktop': {'n': 'Desktop environment'},
|
||
'fw': {'n': 'Firewall & NAT'},
|
||
'monitor': {'n': 'Monitoring & SNMP'},
|
||
'net': {'n': 'Network & diagnostics'},
|
||
'print': {'n': 'Print service'},
|
||
'qos': {'n': 'QoS & traffic'},
|
||
'share': {'n': 'File sharing'},
|
||
'storage': {'n': 'Removable storage & filesystems'},
|
||
'sys': {'n': 'System basics'},
|
||
},
|
||
'DEP_ITEMS': {
|
||
'btrfs-progs': {'d': 'Removable storage: Btrfs with snapshots and checksums', 'n': 'mkfs.btrfs (Btrfs format)'},
|
||
'ca-certs': {'d': 'HTTPS requests and certificate verification', 'n': 'CA root certificates'},
|
||
'chrony': {'d': 'System time synchronisation', 'n': 'chrony (NTP time sync)'},
|
||
'chronyc': {'d': 'Check time sources and offset (same package as chrony)', 'n': 'chronyc (NTP query)'},
|
||
'conntrack': {'d': 'Inspect the connection tracking table and verify acceleration', 'n': 'conntrack (connection tracking)'},
|
||
'coreutils': {'d': 'Disk usage stats and the directory scans on the "Disk & log cleanup" page', 'n': 'df / du / ls (basic tools)'},
|
||
'cups': {'d': 'Printing: share USB / network printers to the LAN. Starts the cups daemon after install', 'n': 'CUPS print service'},
|
||
'cups-client': {'d': 'Printing: add, remove and query printer queues', 'n': 'lpadmin / lpstat (printer admin)'},
|
||
'curl': {'d': 'Diagnostics, WAN checks and the external lookups of the "real public IP decision"', 'n': 'curl (HTTP client)'},
|
||
'dhcpcd': {'d': 'IPv6 prefix delegation and address acquisition', 'n': 'dhcpcd (DHCPv6 client)'},
|
||
'dmidecode': {'d': 'Overview reads BIOS version, board and memory info from it', 'n': 'dmidecode (BIOS/hardware)'},
|
||
'dnsmasq': {'d': 'LAN DHCP and DNS service', 'n': 'dnsmasq (DHCP/DNS)'},
|
||
'dnsmasq-utils': {'d': 'Actively release DHCP leases (falls back to deleting the lease file + reload when missing)', 'n': 'dnsmasq-utils (DHCP tools)'},
|
||
'dnsutils': {'d': 'DNS diagnostics', 'n': 'dnsutils (dig/nslookup)'},
|
||
'docker': {'d': 'Docker container management panel. Starts the docker service after install', 'n': 'Docker engine'},
|
||
'docker-compose': {'d': 'Container orchestration (docker compose up). The path varies by distro; probed one by one here', 'n': 'Docker Compose plugin'},
|
||
'dosfstools': {'d': 'Removable storage: the most universally compatible FAT32', 'n': 'mkfs.vfat (FAT32 format)'},
|
||
'e2fsprogs': {'d': 'Removable storage: Linux-native ext4/ext3, journaling with permission and ACL support', 'n': 'mkfs.ext4 / mkfs.ext3 (ext4 format)'},
|
||
'etherwake': {'d': 'WOL wake-up. Falls back to a Python broadcast magic packet when missing; the feature is unaffected', 'n': 'etherwake (Wake-on-LAN)'},
|
||
'ethtool': {'d': 'NIC state, WOL wake-up, hardware offload', 'n': 'ethtool (NIC tool)'},
|
||
'exfatprogs': {'d': 'Removable storage: first choice for cross-platform portable drives (readable by Windows / macOS / Linux)', 'n': 'mkfs.exfat (exFAT format)'},
|
||
'f2fs-tools': {'d': 'Removable storage: F2FS designed for flash (USB sticks / SSDs / TF cards); reduces write amplification', 'n': 'mkfs.f2fs (F2FS format)'},
|
||
'hostname': {'d': 'Hostname shown on the overview page and in terminal prompts', 'n': 'hostname'},
|
||
'htop': {'d': 'View processes in the web terminal', 'n': 'htop (process monitor)'},
|
||
'iftop': {'d': 'Real-time traffic monitor', 'n': 'iftop (live traffic)'},
|
||
'iperf3': {'d': 'Speed test tool', 'n': 'iperf3 (bandwidth test)'},
|
||
'iproute2': {'d': 'Interface, route and traffic-control management', 'n': 'iproute2 (ip/ss/tc)'},
|
||
'iputils': {'d': 'Connectivity diagnostics', 'n': 'iputils (ping/arping)'},
|
||
'journalctl': {'d': 'Collect system logs into the unified log. Missing means this is not a systemd system; review manually', 'n': 'journalctl (system log)'},
|
||
'kmod': {'d': 'Entry point for loading the CAKE / HTB queue modules and fast-path modules for QoS', 'n': 'modprobe / modinfo (kernel modules)'},
|
||
'lm-sensors': {'d': 'CPU / board temperature probes for the overview hardware dashboard', 'n': 'sensors (temperature & voltage)'},
|
||
'logrotate': {'d': 'Keeps logs from filling the disk. The auto-clean on the "Disk & log cleanup" page depends on it', 'n': 'logrotate (log rotation)'},
|
||
'miniupnpd': {'d': 'UPnP / NAT-PMP automatic port mapping', 'n': 'miniupnpd (UPnP)'},
|
||
'mtr': {'d': 'Continuously trace every hop to a target', 'n': 'mtr (route tracing)'},
|
||
'networkctl': {'d': 'Only used to detect NIC configuration; not installable either', 'n': 'systemd-networkd (networkctl)'},
|
||
'nf-conntrack': {'d': 'NAT and connection tracking dependency', 'n': 'nf_conntrack kernel module'},
|
||
'nf-nat': {'d': 'Address translation dependency', 'n': 'nf_nat kernel module'},
|
||
'nfs-server': {'d': 'File sharing: NFS mounts from Linux / NAS. Auto-enables nfs-server after install', 'n': 'NFS server'},
|
||
'nft-flowtable': {'d': 'Software fast path (flowtable) dependency', 'n': 'nf_flow_table kernel module'},
|
||
'nftables': {'d': 'IPv4/IPv6 firewall and software fast path', 'n': 'nftables firewall'},
|
||
'nmcli': {'d': 'Only used to detect how NICs are configured. Intentionally not installable: NetworkManager would fight the router config for the NICs', 'n': 'NetworkManager (nmcli)'},
|
||
'ntfs-3g': {'d': 'Removable storage: Windows-compatible NTFS', 'n': 'mkfs.ntfs (NTFS format)'},
|
||
'opensoho': {'d': 'AC/AP centre: centrally manage OpenWRT AP Wi-Fi / VLAN / PoE. Not an apt package; install it on the "Services -> AC/AP centre" page', 'n': 'OpenSOHO (AC / AP controller)'},
|
||
'openssl': {'d': 'Generate the panel\'s self-signed certificate, import CA certs, SSL tests', 'n': 'OpenSSL (cert tool)'},
|
||
'p7zip': {'d': 'Compress large files', 'n': '7z (high compression)'},
|
||
'pppd': {'d': 'Broadband PPPoE dialing', 'n': 'pppd (PPPoE dial-up)'},
|
||
'procps': {'d': 'Overview process list and service status queries', 'n': 'ps / pkill (process tools)'},
|
||
'python3': {'d': 'Foundation of the backend and management services', 'n': 'Python 3 runtime'},
|
||
'radvd': {'d': 'IPv6 Router Advertisement', 'n': 'radvd (IPv6 RA)'},
|
||
'samba': {'d': 'File sharing: shared folders for Windows / macOS. Debian auto-enables smbd after install', 'n': 'Samba (SMB/CIFS share)'},
|
||
'samba-common': {'d': 'File sharing: set access accounts for SMB shares', 'n': 'Samba account tool (smbpasswd)'},
|
||
'smartmontools': {'d': 'Removable storage: read SMART health. Optional because installing starts the smartd daemon', 'n': 'smartctl (disk health)'},
|
||
'snmp-cli': {'d': 'SNMP monitoring: verify snmpd actually answers during the self-check', 'n': 'snmpwalk / snmpget (SNMP client)'},
|
||
'snmpd': {'d': 'SNMP monitoring: let NMS software poll traffic and interface data. Starts snmpd after install', 'n': 'snmpd (SNMP server)'},
|
||
'socat': {'d': 'Serial/TCP debugging', 'n': 'socat (port tool)'},
|
||
'sqlite3': {'d': 'Configuration database (Python\'s built-in sqlite3 also works)', 'n': 'SQLite3 (config DB)'},
|
||
'sudo': {'d': 'Privileged operations called from the low-privilege backend', 'n': 'sudo (privilege whitelist)'},
|
||
'systemd': {'d': 'Service and timer hosting. No one-click install when missing (the system form needs manual review)', 'n': 'systemd (service manager)'},
|
||
'tar': {'d': 'Theme import/export, config backup packing', 'n': 'tar (archiver)'},
|
||
'tc': {'d': 'QoS shaping and queueing (CAKE / HTB)', 'n': 'tc (traffic control)'},
|
||
'tcpdump': {'d': 'On-interface packet diagnostics', 'n': 'tcpdump (packet capture)'},
|
||
'traceroute': {'d': 'Diagnostic tool', 'n': 'traceroute (route tracing)'},
|
||
'udev': {'d': 'USB printer / removable drive hot-plug detection and RAW passthrough permissions', 'n': 'udevadm (device events)'},
|
||
'usbutils': {'d': 'Removable storage & USB printers: list devices and vendor IDs on the USB bus', 'n': 'lsusb (USB device list)'},
|
||
'util-linux': {'d': 'Removable storage: detect devices, size and connection type (USB / Thunderbolt / NVMe), mount and unmount', 'n': 'lsblk / mount (block devices)'},
|
||
'vim': {'d': 'Edit config files in the web terminal', 'n': 'vim (editor)'},
|
||
'vnc': {'d': 'Remote graphical desktop. This system never modifies it; only prompts when missing', 'n': 'RealVNC Server'},
|
||
'wget': {'d': 'Command-line downloads', 'n': 'wget (downloader)'},
|
||
'wireguard-tools': {'d': 'VPN server: reach your LAN from outside. Without it the VPN page cannot generate keys or edit the config', 'n': 'WireGuard tools (wg / wg-quick)'},
|
||
'xfce': {'d': 'Desktop environment. Only if you want a GUI; the router itself does not need one', 'n': 'XFCE desktop environment'},
|
||
'xfsprogs': {'d': 'Removable storage: strong with large files and concurrent writes; deletes many small files quickly', 'n': 'mkfs.xfs (XFS format)'},
|
||
'xorg': {'d': 'GUI foundation (installed with the desktop)', 'n': 'Xorg display server'},
|
||
'zip': {'d': 'Compress folders for download', 'n': 'zip / unzip (archived download)'},
|
||
},
|
||
# Docker 镜像源（helper DCFG_MIRRORS，列表形态）—— 见上方 DPI_HOSTS 的说明。
|
||
'DCFG_MIRRORS': {
|
||
'aliyun': {'d': 'Aliyun no longer offers a generic accelerator URL. Get your own https://xxxx.mirror.aliyuncs.com address from the Container Registry console and fill it in as the custom mirror below.', 'n': 'Aliyun (dedicated URL required)'},
|
||
'daocloud': {'d': 'DaoCloud public accelerator — good availability in China.', 'n': 'DaoCloud'},
|
||
'netease': {'d': 'NetEase\'s long-standing mirror — stable, occasionally lags on sync.', 'n': 'NetEase'},
|
||
'nju': {'d': 'NJU open-source mirror; preferred by CERNET users.', 'n': 'Nanjing University'},
|
||
'sjtug': {'d': 'SJTUG mirror; fast in East China.', 'n': 'Shanghai Jiao Tong University'},
|
||
'tencent': {'d': 'Tencent Cloud public mirror — stable long-term, no login needed.', 'n': 'Tencent Cloud'},
|
||
'ustc': {'d': 'Good on CERNET and China Telecom links; may throttle at peak.', 'n': 'USTC'},
|
||
},
|
||
'DPI_INSTALL_PLANS': {
|
||
'apt': {'name': 'APT install (easiest)', 'why': 'Install straight from the Debian 13 repositories, no compiling. The nDPI version may be slightly older but is fine for home use.'},
|
||
'netfilter': {'name': 'nDPI Netfilter kernel module', 'why': 'Provides xt_ndpi so nftables/iptables can mark traffic by application. You have to compile it yourself.'},
|
||
'source': {'name': 'Build nDPI from source (newest)', 'why': 'Gives you the newest protocol signature database (faster recognition of new apps), but compiling takes a while.'},
|
||
},
|
||
'DPI_NOTES': {
|
||
'DPI 需要独立进程（nDPI Reader / Suricata），会额外占用内存；本机为 4GB 内存的虚拟机，建议只装 nDPI 一项。': {'d': 'DPI needs its own process (nDPI Reader / Suricata) and costs extra memory. This host is a 4GB VM, so install nDPI alone.'},
|
||
'加密流量（HTTPS/QUIC）无法被 DPI 完整识别，这是所有厂商的共同限制。': {'d': 'Encrypted traffic (HTTPS/QUIC) cannot be fully identified by DPI — a limitation shared by every vendor.'},
|
||
'规则库默认从 GitHub 获取，国内直连常常超时 —— 请在下方选择加速前缀。': {'d': 'The ruleset is fetched from GitHub by default and direct connections from China often time out — pick an acceleration prefix below.'},
|
||
},
|
||
'DPI_SOURCES': {
|
||
'ndpi-netfilter': {'name': 'nDPI Netfilter kernel module', 'why': 'Provides xt_ndpi so nftables / iptables can mark by application directly. You have to build it yourself.'},
|
||
'ndpi-protos': {'name': 'nDPI protocol definitions', 'why': 'nDPI’s protocol signatures (src/lib/protocols + lists) — the core data for "what app is this".'},
|
||
'suricata-rules': {'name': 'Suricata app-detection rules', 'why': 'The suricata-update tool and its default rule sources, used for application-layer blocking and marking.'},
|
||
},
|
||
'FS_TYPES': {
|
||
'btrfs': {'note': 'Supports snapshots, checksums and online expansion. Turn off copy-on-write (nodatacow) for Samba shares to avoid fragmentation.'},
|
||
'exfat': {'note': 'Best cross-platform choice: Windows / macOS / Linux all read and write it natively, no 4 GB per-file limit — ideal for portable drives.'},
|
||
'ext3': {'note': 'The predecessor of ext4. Only use it when you must talk to very old hardware.'},
|
||
'ext4': {'note': 'The Linux choice: journalled, stable, supports permissions and ACLs. Windows / macOS need a third-party driver to read or write it.'},
|
||
'f2fs': {'note': 'Designed for flash (USB sticks / SSDs / TF cards); noticeably reduces write amplification and extends lifetime.'},
|
||
'ntfs': {'note': 'Native on Windows. Writing from Linux needs ntfs-3g (kernels 5.15+ have a native driver); macOS mounts it read-only by default.'},
|
||
'vfat': {'note': 'Widest compatibility (TVs / car head units / cameras / consoles all accept it). Limits: files ≤ 4 GB, partitions ≤ 2 TB.'},
|
||
'xfs': {'note': 'Handles large files and concurrent writes well, and is fast at deleting many small files. Partitions cannot be shrunk once created.'},
|
||
},
|
||
'IFACE_DRVSRC': {
|
||
'内核/其它': {'en': 'Kernel / other', 'kind': 'warn'},
|
||
'内核内建': {'en': 'Kernel built-in', 'kind': 'ok'},
|
||
'发行版官方源': {'en': 'Distro official package', 'kind': 'ok'},
|
||
'未知': {'en': 'Unknown', 'kind': 'gray'},
|
||
'第三方(DKMS)': {'en': 'Third-party (DKMS)', 'kind': 'warn'},
|
||
'第三方(手工编译)': {'en': 'Third-party (manually built)', 'kind': 'warn'},
|
||
},
|
||
'IFACE_METHOD': {
|
||
'DHCP 自动': {'en': 'DHCP auto', 'kind': 'info'},
|
||
'手动': {'en': 'Manual', 'kind': 'gray'},
|
||
'未配置': {'en': 'Not configured', 'kind': 'gray'},
|
||
'静态地址': {'en': 'Static address', 'kind': 'warn'},
|
||
},
|
||
'KERN_FW_ITEMS': {
|
||
'masquerade_v4': {'name': 'IPv4 outbound masquerade (SNAT)', 'why': 'Rewrites the private addresses of LAN devices to the router’s own WAN address. A home broadband line usually gets a single public IP, so dozens of devices share one egress through it.'},
|
||
'masquerade_v6': {'name': 'IPv6 outbound masquerade (NAT66)', 'why': 'The IPv6 flavour of address masquerading. Normally unnecessary — IPv6 has enough addresses that every device can have its own public one.'},
|
||
'mss_v4': {'name': 'IPv4 MSS clamping', 'why': 'During the TCP handshake it clamps the maximum segment size to what the link can carry. It is the standard fix for "some sites will not load, images stall halfway, WeChat cannot send pictures" after PPPoE dial-up.'},
|
||
'mss_v6': {'name': 'IPv6 MSS clamping', 'why': 'Same idea as IPv4, but IPv6 negotiates via PMTUD (path MTU discovery) on its own, so manual intervention is rarely needed.'},
|
||
},
|
||
'KERN_IMPACT': {
|
||
'IPv6 不走 NAT，内网设备通常直接拿到公网 v6 地址。所以「转发开了但上不了网」多半是前缀委派（PD）没拿到，去「DHCPv6 / 前缀委派」页看': {'en': 'IPv6 does not use NAT; LAN devices usually get a public v6 address directly. So if forwarding is on but there is still no Internet, prefix delegation (PD) is most likely missing - check the DHCPv6 / Prefix Delegation page.'},
|
||
'clamp（按路由 MTU 自动算）适合绝大多数场景，MTU 变了不用改配置': {'en': 'clamp (derived from the route MTU) fits almost every setup; nothing to change when MTU changes.'},
|
||
'fixed（写死数值）只在多拨 / 隧道 / GRE 这类 MTU 不统一的场景才需要': {'en': 'fixed (a hard-coded value) is only needed where MTU is inconsistent, e.g. multi-dial, tunnels or GRE.'},
|
||
'会同时把默认队列规则设为 fq（BBR 的搭档）。若你在「智能限速 QoS」里手工指定了 qdisc，以 QoS 页为准': {'en': 'It also sets the default qdisc to fq (BBR companion). If you set a qdisc manually under Smart QoS, the QoS page wins.'},
|
||
'会在 UDP 161 开一个监听。团体名（community）相当于只读口令，建议别用默认的 public，并用防火墙限制可访问的网段': {'en': 'It opens a UDP 161 listener. The community name works as a read-only password - avoid the default public and restrict reachable subnets with the firewall.'},
|
||
'做了伪装之后外网看不到内网真实 IP，所以「从外网访问内网服务」才需要单独配端口转发或 DMZ': {'en': 'With masquerade on, the Internet cannot see real LAN addresses, so publishing an internal service requires port forwarding or DMZ.'},
|
||
'关掉之后内网就上不了网 —— 除非上游路由器已经写了回程路由，知道「内网网段走 192.168.7.3」': {'en': 'Turning it off cuts the LAN off from the Internet - unless the upstream router already has a return route sending the LAN subnet to 192.168.7.3.'},
|
||
'单独打开它网络不会立刻变化 —— 还得配合出向地址伪装（masquerade）和正确的路由表，内网才能真正上网': {'en': 'Enabling it alone changes nothing right away - outbound masquerade and a correct routing table are also required before the LAN can really reach the Internet.'},
|
||
'只影响本机自己发起和终结的 TCP 连接（路由器上跑的代理、下载、Docker 拉镜像等），不会影响「经过本机转发」的别人家流量 —— 拥塞控制是通信两端的事，中间的路由器改不了': {'en': 'It only affects TCP connections originated or terminated by this host (proxies, downloads, Docker pulls), not traffic merely forwarded through it - congestion control belongs to the two endpoints and a middlebox cannot change it.'},
|
||
'只有 PPPoE / 隧道把 MTU 压到 1500 以下时才需要考虑打开': {'en': 'Only worth enabling when PPPoE or a tunnel pushes MTU below 1500.'},
|
||
'只有「上游只给一个 /64 且不再下发前缀委派」时才需要它': {'en': 'Only needed when the upstream hands out a single /64 with no further prefix delegation.'},
|
||
'它只决定「转不转」，不决定「安不安全」；访问控制由防火墙规则说了算': {'en': 'It only decides whether packets are forwarded, not whether that is safe - access control is decided by firewall rules.'},
|
||
'将来真正接管路由后，WAN 口照收上游 RA、LAN 口由 radvd 自己发 RA，那时再按接口细分即可': {'en': 'Once it really takes over routing, the WAN port still accepts upstream RAs while radvd sends RAs on LAN; per-interface tuning can wait until then.'},
|
||
'打开 IPv6 转发后，内核就不再接受 accept_ra=1 下的路由通告，靠 SLAAC 拿地址的家宽会在租期到期后丢掉整个 IPv6。本页开启时会自动同时设置 accept_ra=2（意为「开了转发也照收 RA」），这是 OpenWrt / RouterOS 等固件的标准做法': {'en': 'With IPv6 forwarding on, the kernel no longer accepts router advertisements under accept_ra=1, so SLAAC-only home links lose IPv6 entirely when the lease expires. Enabling it here also sets accept_ra=2 (keep accepting RAs while forwarding), the standard practice of OpenWrt / RouterOS and other firmwares.'},
|
||
'打开后内网设备对外只呈现一个 v6 地址，BT、摄像头 P2P、远程桌面这类需要入向连接的应用会失效': {'en': 'Once on, LAN devices expose a single v6 address outward, so apps needing inbound connections (BT, camera P2P, remote desktop) stop working.'},
|
||
'改动后要到「防火墙 IPv4」页点一次「保存并应用」才会生效': {'en': 'After a change, click Save and apply once on the IPv4 firewall page for it to take effect.'},
|
||
'设得太小会让每个包装的数据变少、网速略降；PPPoE 一般 1452，普通以太网 1500 即可': {'en': 'Too small a value leaves less payload per packet and slightly lowers throughput; 1452 for PPPoE, 1500 for plain Ethernet.'},
|
||
'需要先安装 snmpd；没装时本页会提示去「依赖自检与安装」安装': {'en': 'snmpd must be installed first; when it is missing this page points you to Dependency check and install.'},
|
||
'需要内核模块 tcp_bbr（Debian 13 自带）。加载失败会自动退回 cubic，页面会如实显示当前实际生效的算法': {'en': 'Needs kernel module tcp_bbr (shipped with Debian 13). If loading fails it falls back to cubic and the page shows the algorithm actually in effect.'},
|
||
'默认关闭，这是 IPv6 的推荐做法': {'en': 'Off by default - the recommended setting for IPv6.'},
|
||
'默认关闭：家用环境一般用不到，多一个监听就多一分风险': {'en': 'Off by default: rarely needed at home, and every extra listener adds risk.'},
|
||
'默认关闭；打开了却没问题也建议关掉，少一层改写': {'en': 'Off by default; even when enabling it causes no problem, keeping it off means one less layer of rewriting.'},
|
||
},
|
||
'KERN_ITEMS': {
|
||
'bbr': {'name': 'BBR congestion control', 'why': 'Google\'s TCP congestion control algorithm. On links with loss or elevated latency it reaches the available bandwidth with lower latency than the system default (cubic).'},
|
||
'fwd_v4': {'name': 'IPv4 forwarding', 'why': 'Decides whether this host forwards packets for others. With it off the machine is just an ordinary host on the LAN and drops packets not addressed to it; with it on the machine actually gains router capability.'},
|
||
'fwd_v6': {'name': 'IPv6 forwarding', 'why': 'The same, for IPv6. If the broadband line has no IPv6 it makes no difference either way.'},
|
||
'snmp': {'name': 'SNMP monitoring', 'why': 'Opens a standard SNMP service so network management software (Zabbix / PRTG / Cacti / LibreNMS) can collect interface traffic, CPU and memory metrics.'},
|
||
},
|
||
'NAT_TYPES': {
|
||
'NA': {'d': 'Not enough samples to judge reliably', 't': 'Unknown'},
|
||
'NAT1': {'d': 'The most compatible NAT type. Any external host can reach you back through this mapped port, which suits P2P, remote gaming and self-hosted services.', 't': 'NAT1 · Full Cone'},
|
||
'NAT2': {'d': 'The public address is stable but the mapped port varies per destination. Once you have contacted a host first, it can connect back. Fine for everyday browsing and gaming.', 't': 'NAT2 · Address-Restricted Cone'},
|
||
'NAT3': {'d': 'You are behind carrier-grade NAT: the mapping points at an address inside the ISP network. P2P and port mapping succeed far less often.', 't': 'NAT3 · Port-Restricted Cone'},
|
||
'NAT4': {'d': 'Every destination gets a different mapped address, so compatibility is worst. Common on corporate or carrier symmetric NAT; P2P basically needs a relay.', 't': 'NAT4 · Symmetric'},
|
||
'NONE': {'d': 'This host’s own address matches the public mapping exactly — it is exposed to the internet directly.', 't': 'Direct public exposure (no NAT)'},
|
||
},
|
||
'NFS_PRESETS': {
|
||
'legacy': {'n': 'Legacy devices (insecure)', 'why': 'May be needed for older players and thin clients; it lets the client root write directly, which is risky — use it only on a trusted LAN.'},
|
||
'linux': {'n': 'Linux clients (recommended)', 'why': 'root_squash maps the client root to an anonymous user — the safest option and works with virtually every distribution.'},
|
||
'macos': {'n': 'macOS clients', 'why': 'macOS may mount from a source port above 1024, so insecure is required; all_squash avoids permission conflicts.'},
|
||
'readonly': {'n': 'Read-only export', 'why': 'Read-only, which suits sharing media sources or mirror repositories.'},
|
||
'windows': {'n': 'Windows (WSL2 / Client for Windows)', 'why': 'The Windows NFS client handles permission mapping unusually; pinning the anonymous uid/gid to nobody (65534) is simplest.'},
|
||
},
|
||
'OH_ITEMS': {
|
||
'autostart': {'name': 'Start on boot', 'why': 'Decides whether OpenSOHO comes up on its own after the machine reboots.'},
|
||
'bind': {'name': 'Listen address', 'why': 'Decides who can reach the controller. APs must be able to connect in order to register, so it has to listen on the LAN.'},
|
||
'enable_new_devices': {'name': 'Adopt new APs automatically', 'why': 'When OpenSOHO discovers a new AP, should it push the configuration to it or just watch it?'},
|
||
'encryption': {'name': 'Encrypt stored config at rest', 'why': 'OpenSOHO\'s settings collection holds sensitive items such as Wi-Fi passwords. Turning this on encrypts those values on disk.'},
|
||
'install': {'name': 'How to install', 'why': 'OpenSOHO is not an apt package; it is a self-contained Go binary. If the router can reach GitHub, one click installs it; otherwise transfer the file in from another machine.'},
|
||
'secret': {'name': 'Shared secret', 'why': 'This is what you paste into openwisp-config on the AP side; get it wrong and registration fails. drouter generates and keeps it — copy it straight from this page.'},
|
||
},
|
||
'OPENAPI_TEXTS': {
|
||
'DHCP 租约': {'en': 'DHCP leases'},
|
||
'DPI 更新日志': {'en': 'DPI update log'},
|
||
'DPI 识别库：状态/代理测速/更新': {'en': 'DPI signature DB: status/proxy speed test/update'},
|
||
'Docker / Compose 面板：状态查询、容器运维、镜像/网络/卷、Compose 项目管理、docker run → compose 转换': {'en': 'Docker / Compose panel: status, container ops, images/networks/volumes, Compose projects, docker run -> compose conversion'},
|
||
'Go（net/http 标准库）': {'en': 'Go (net/http standard library)'},
|
||
'IPv6 地址与 RA 状态': {'en': 'IPv6 addresses and RA status'},
|
||
'Java 11+（HttpClient）': {'en': 'Java 11+ (HttpClient)'},
|
||
'JavaScript / Node.js / 浏览器 fetch': {'en': 'JavaScript / Node.js / browser fetch'},
|
||
'NAT 类型自动检测（STUN）': {'en': 'Automatic NAT type detection (STUN)'},
|
||
'PHP（file_get_contents / curl 通用写法）': {'en': 'PHP (file_get_contents / curl)'},
|
||
'PPPoE 单会话日志与排错建议': {'en': 'PPPoE per-session log and troubleshooting hints'},
|
||
'PPPoE 多拨：查询/保存/应用/启停/单会话操作': {'en': 'PPPoE multi-session: query/save/apply/start-stop/per-session ops'},
|
||
'PowerShell（Windows）': {'en': 'PowerShell (Windows)'},
|
||
'Python（仅用标准库 requests 可省）': {'en': 'Python (standard library only; requests optional)'},
|
||
'QoS 智能限速：查询/保存/启用/停用/重置': {'en': 'QoS smart shaping: query/save/enable/disable/reset'},
|
||
'Shell（wget 版，无 curl 环境）': {'en': 'Shell (wget variant, when curl is absent)'},
|
||
'VLAN 接口 查询/保存/应用/删除': {'en': 'VLAN interfaces: query/save/apply/delete'},
|
||
'WAN 接入': {'en': 'WAN access'},
|
||
'WAN 接入方式统一实时日志与状态（PPPoE/DHCP/静态/双栈/桥接）': {'en': 'Unified live log and status for the WAN access mode (PPPoE/DHCP/static/dual-stack/bridge)'},
|
||
'WOL 网络唤醒 / 网卡能力查询': {'en': 'WOL wake-on-LAN / NIC capability query'},
|
||
'cURL（最通用，Linux/macOS/Windows 均可）': {'en': 'cURL (most universal; Linux/macOS/Windows)'},
|
||
'nftables flowtable 软加速 开关/查询': {'en': 'nftables flowtable software fast path on/off/query'},
|
||
'一键安装缺失依赖': {'en': 'One-click install of missing dependencies'},
|
||
'上游链路详情（IPv4/IPv6 协议、地址、网关、DNS、DHCPv6 统计）': {'en': 'Upstream link details (IPv4/IPv6 protocol, address, gateway, DNS, DHCPv6 stats)'},
|
||
'下载指定版本的安装包（先备份→官方源下载→SHA256 校验）': {'en': 'Download the package of a given version (backup first -> official source -> SHA256 verify)'},
|
||
'下载文件': {'en': 'Download file'},
|
||
'中断正在进行的更新下载': {'en': 'Abort the update download in progress'},
|
||
'主题之家': {'en': 'Themes'},
|
||
'主题保存 / 删除 / 应用 / 复位 / 导出 / 导入 / 预览 / 配色': {'en': 'Theme save / delete / apply / reset / export / import / preview / palette'},
|
||
'主题列表 / 主题详情 / 可定制变量清单': {'en': 'Theme list / theme details / customisable variable list'},
|
||
'二层网络': {'en': 'L2 network'},
|
||
'健康检查（无需登录）': {'en': 'Health check (no login required)'},
|
||
'关键词搜索': {'en': 'Keyword search'},
|
||
'内网文件共享 SMB / NFS：查询/保存/启停/建目录/渲染预览': {'en': 'LAN file sharing SMB / NFS: query/save/on-off/mkdir/preview'},
|
||
'列目录': {'en': 'List directory'},
|
||
'创建快照': {'en': 'Create snapshot'},
|
||
'删除（走回收站）': {'en': 'Delete (goes to trash)'},
|
||
'动态域名 DDNS：查询/保存/启停/公网检测/立即更新': {'en': 'Dynamic DNS: query/save/on-off/public-IP check/update now'},
|
||
'原始 HTTP 报文（任何 HTTP 客户端 / 工单系统 / IoT）': {'en': 'Raw HTTP messages (any HTTP client / ticketing system / IoT)'},
|
||
'受管服务状态': {'en': 'Managed service status'},
|
||
'只读观测': {'en': 'Read-only observation'},
|
||
'回滚到指定快照': {'en': 'Roll back to a given snapshot'},
|
||
'外置存储设备（USB / Type-C / 雷电）：识别设备、挂载、卸载、格式化（ext4/xfs/btrfs/f2fs/exfat/ntfs/vfat）、开机自动挂载': {'en': 'Removable storage (USB / Type-C / Thunderbolt): detect, mount, unmount, format (ext4/xfs/btrfs/f2fs/exfat/ntfs/vfat), mount at boot'},
|
||
'安全': {'en': 'Security'},
|
||
'审计': {'en': 'Audit'},
|
||
'审计日志': {'en': 'Audit log'},
|
||
'寻址与路由': {'en': 'Addressing & routing'},
|
||
'工具': {'en': 'Tools'},
|
||
'应用配置（渲染 + 校验 + 回滚保护）': {'en': 'Apply config (render + validate + rollback protection)'},
|
||
'当前连接跟踪表快照（conntrack -L，含传输字节）': {'en': 'Snapshot of the current connection tracking table (conntrack -L, with byte counters)'},
|
||
'快照列表': {'en': 'Snapshot list'},
|
||
'打包 zip': {'en': 'Pack as zip'},
|
||
'文件校验值': {'en': 'File checksum'},
|
||
'文件管理': {'en': 'File management'},
|
||
'新建目录': {'en': 'Create directory'},
|
||
'日志': {'en': 'Logs'},
|
||
'日志与审计': {'en': 'Logging & audit'},
|
||
'时间同步状态': {'en': 'Time sync status'},
|
||
'服务': {'en': 'Services'},
|
||
'版本更新': {'en': 'Version update'},
|
||
'登入获取 Token': {'en': 'Log in to get a token'},
|
||
'目标路径': {'en': 'Target path'},
|
||
'端口转发与 DMZ：查询/保存（渲染为 nftables DNAT）': {'en': 'Port forwarding and DMZ: query/save (rendered as nftables DNAT)'},
|
||
'系统日志': {'en': 'System logs'},
|
||
'系统概览（CPU / 内存 / 磁盘 / 进程 / 温度 / 虚拟化）': {'en': 'System overview (CPU / memory / disk / processes / temperature / virtualisation)'},
|
||
'系统维护': {'en': 'System maintenance'},
|
||
'统一日志配置与采集能力自检': {'en': 'Unified log config and collection capability self-check'},
|
||
'网络加速': {'en': 'Network acceleration'},
|
||
'网络接口列表': {'en': 'Network interface list'},
|
||
'网络诊断': {'en': 'Network diagnostics'},
|
||
'访问控制与家长时间组：查询/保存/启停/渲染预览（nftables）': {'en': 'Access control and parental time groups: query/save/on-off/preview (nftables)'},
|
||
'读取全部结构化配置': {'en': 'Read all structured config'},
|
||
'读取文本（预览）': {'en': 'Read text (preview)'},
|
||
'路由表': {'en': 'Routing table'},
|
||
'运行依赖自检': {'en': 'Runtime dependency self-check'},
|
||
'连接跟踪与统一日志：查询/当前连接表/保存保留策略/清理/导出': {'en': 'Connection tracking and unified logs: query/current connections/save retention/clean/export'},
|
||
'通用': {'en': 'General'},
|
||
'邻居表 / 路由表 / IPv6 规则表': {'en': 'Neighbour table / routing table / IPv6 rule table'},
|
||
'配置渲染预览（只读，不写盘）': {'en': 'Config render preview (read-only, nothing written to disk)'},
|
||
'配置管理': {'en': 'Config management'},
|
||
'重命名': {'en': 'Rename'},
|
||
'鉴权': {'en': 'Auth'},
|
||
'防火墙规则快照': {'en': 'Firewall rules snapshot'},
|
||
},
|
||
'PAGE_NOTES': {
|
||
'Debian 13 仓库直接装，无需编译。nDPI 版本可能略旧，但够家用。': {'d': 'Install straight from the Debian 13 repositories, no compiling. The nDPI version may be slightly older but is fine for home use.'},
|
||
'Docker 面板支持容器/镜像/网络/卷的日常运维，以及 Compose 项目管理。「命令转换」可以把任意 docker run 命令转成 docker-compose.yml。': {'d': 'This panel handles day-to-day container, image, network and volume work plus Compose project management. The command converter turns any docker run command into docker-compose.yml.'},
|
||
'SMB 面向 Windows / macOS / Linux 全平台，兼容性最好；NFS 更适合 Linux 之间互传，性能更高但 Windows 需要额外客户端。两者可以同时开启，共享同一个目录。': {'d': 'SMB covers Windows, macOS and Linux with the best compatibility; NFS suits transfers between Linux machines and performs better, but Windows needs an extra client. Both can be enabled at once and share the same directory.'},
|
||
'不使用任何代理。海外网络或已自建代理时选这个。': {'d': 'No proxy at all. Pick this when you are outside China or already run your own proxy.'},
|
||
'备用加速，支持 release 文件与 raw 文件。': {'d': 'A backup accelerator supporting both release files and raw files.'},
|
||
'外接 U 盘 / 移动硬盘 / Type-C 与雷电硬盘盒会显示在下方。「连接方式」显示的是总线类型（USB / 雷电 / NVMe / SATA）；Type-C 是插头形态，电气上仍归 USB 或雷电，因此按总线展示更准确。': {'d': 'External USB drives, portable disks and Thunderbolt enclosures are listed below.'},
|
||
'当前内核里没有 drouter 的防火墙规则（nft 规则集为空），还没有任何包经过本机的防火墙链，所以这里不会有记录。请到「防火墙 IPv4 / IPv6」页面点一次「应用」，规则载入后即可开始记录。': {'d': 'There are no drouter firewall rules in the kernel yet (the nft ruleset is empty), so no packet has traversed the firewall chain and there is nothing to show. Open the "Firewall IPv4 / IPv6" page and click "Apply" once — recording starts as soon as the rules are loaded.'},
|
||
'所有接口统一返回 {"ok":..,"msg_cn":..,"data":..}；失败时 ok=false。除 /api/health、/api/login 外均需 X-Token 头。': {'d': 'Every endpoint returns {"ok":..,"msg_cn":..,"data":..}; on failure ok=false. Everything except /api/health and /api/login requires the X-Token header.'},
|
||
'按 Diffserv 分为三档：语音（CS7/CS6/EF/VA，占 25% 带宽份额，Codel 间隔缩短）、尽力（普通流量，占满带宽）、批量（CS1/LE，低优先级，只分到 6.25% 带宽份额，用于下载 / BT / 视频等大流量）。': {'d': 'Three tiers by Diffserv: voice (CS7/CS6/EF/VA, 25% of bandwidth, shorter Codel intervals), best-effort (normal traffic, full bandwidth) and bulk (CS1/LE, lowest priority, 6.25% of bandwidth).'},
|
||
'时间规则按北京时间（UTC+8）换算后写入内核；跨零点的时间段会自动拆成两段。应用识别依赖 DPI 库，限速动作依赖 QoS 模块。': {'d': 'Time rules are converted to Beijing time (UTC+8) before being written into the kernel; a period crossing midnight is split into two. App identification relies on the DPI database, and rate-limit actions rely on the QoS module.'},
|
||
'真正的 Wi-Fi、VLAN、PoE 配置都在 OpenSOHO 自己的控制台里做 —— 这里只负责把它装好、管住、把入口给你。AP 侧需要在 OpenWRT 上装 openwisp-config 并填入下面的共享密钥来注册。': {'d': 'The actual Wi-Fi, VLAN and PoE configuration is done in OpenSOHO\\u2019s own console \\u2014 this page only installs it, keeps it running and gives you the entry point.'},
|
||
'老牌公共加速，稳定性一般，偶尔限流。': {'d': 'A long-standing public accelerator: fairly stable but occasionally rate-limited.'},
|
||
'防火墙日志开关当前为关闭：规则里不会生成 log 语句，因此这里不会有新记录。': {'d': 'The firewall logging switch is currently off: the rules contain no log statements, so no new records will appear here.'},
|
||
},
|
||
'PPPM_NOTES': {
|
||
'多拨会改变出网路由，请确认已填好账号并显式点击「应用并连接」。': {'d': 'Multi-dial changes the outbound routing, so fill the account in and click Apply and connect explicitly.'},
|
||
'多拨能否成功取决于运营商是否允许同一账号并发拨号（部分省份限制为 1 条）。': {'d': 'Whether multi-dial succeeds depends on whether the ISP allows concurrent dialling on one account (some regions cap it at a single session).'},
|
||
'尝试 N 个会话前，建议先只用 1 条确认账号可正常拨通。': {'d': 'Before trying N sessions, dial with just one to confirm the account works.'},
|
||
'若运营商拒绝并发，会话会反复重拨并在这页显示为「未连接」，属正常现象。': {'d': 'If the ISP refuses concurrent sessions, they keep re-dialling and show as not connected here — that is normal.'},
|
||
},
|
||
'PPPM_STRATEGIES': {
|
||
'balance': {'name': 'Load balance (even split across sessions)', 'why': 'All sessions carry traffic at once, so total throughput is roughly the sum. Suits carriers that allow multi-dial.'},
|
||
'primary_backup': {'name': 'Primary/backup (automatic failover)', 'why': 'Only the first session is used and the rest stand by; traffic switches to the backup when the primary link drops. Suits flaky multi-dial or conserving resources.'},
|
||
'weighted': {'name': 'Weighted (custom weight per session)', 'why': 'Distributes traffic by weight — e.g. two 500M lines plus one 200M line can be set to 5:5:2.'},
|
||
},
|
||
'PRINT_DRIVERS': {
|
||
'everywhere': {'name': 'Automatic (IPP Everywhere, driverless)', 'note': 'Recommended. Most network printers from 2015 onward, plus AirPrint / Mopria devices, support this. The router does no format conversion — the printer parses it itself.'},
|
||
'raw': {'name': 'Raw (pass through, no conversion)', 'note': 'The client must have the printer driver installed and send already-rendered data. Suits old printers, or cases where the driver will not install on the router.'},
|
||
},
|
||
'PRINT_IMPACT': {
|
||
'CUPS 模式：功能最全，手机 / 电脑免驱就能打，但要多跑一个守护进程': {'en': 'CUPS mode: the most complete feature set, driverless printing from phones and PCs, at the cost of one more daemon.'},
|
||
'RAW 直通模式：最省资源、兼容性最好（驱动全在客户端），但客户端必须自己装驱动，也没有队列管理': {'en': 'RAW passthrough: lightest on resources and most compatible (drivers live on the client), but clients must install drivers themselves and there is no queue management.'},
|
||
'依赖 avahi-daemon。它没运行时能打印但发现不了，页面会提示': {'en': 'Depends on avahi-daemon. Without it printing still works but discovery fails, and the page says so.'},
|
||
'关掉不影响打印，只是 631 上的网页打不开': {'en': 'Turning it off does not affect printing, only the web page on 631 becomes unreachable.'},
|
||
'关掉后，已自动生成的队列会消失（手工添加的队列不受影响）': {'en': 'After turning it off, auto-generated queues disappear (manually added queues are kept).'},
|
||
'关闭：把所有打印服务都停掉，端口不再监听': {'en': 'Off: stops all print services and listens on no port.'},
|
||
'它也会把本机的队列再广播出去，供其他机器发现': {'en': 'It also re-advertises this host queues so other machines can discover them.'},
|
||
'将来这台机器真正接管路由后，如果防火墙改了策略，需要确认入站仍然放行 631': {'en': 'Once this host really takes over routing, if firewall policy changes confirm inbound 631 is still allowed.'},
|
||
'开着方便排障；讲究的话可以在打完配置后关掉': {'en': 'Handy while troubleshooting; you may turn it off once configuration is done.'},
|
||
'打开后 CUPS 会监听全部地址的 631 端口': {'en': 'When enabled, CUPS listens on 631 on all addresses.'},
|
||
'打开后会通过 mDNS（avahi）在局域网里广播，iPhone / Android / Windows / macOS 才能自动发现': {'en': 'When enabled it advertises over mDNS (avahi) on the LAN so iPhone / Android / Windows / macOS can auto-discover it.'},
|
||
'打开后同网段的任何人都能改打印配置，只在可信网络里开': {'en': 'When enabled anyone on the same subnet can change printing settings - only enable on trusted networks.'},
|
||
'本页会把访问范围限制在 @LOCAL（直连网段），WAN 侧的机器访问不到 —— 不会把打印机暴露到公网': {'en': 'This page limits access to @LOCAL (the directly connected subnet); machines on the WAN side cannot reach it, so the printer is never exposed to the Internet.'},
|
||
'没有插 USB 打印机时，RAW 模式没有意义 —— 页面会如实提示': {'en': 'With no USB printer attached, RAW mode is pointless - the page says so plainly.'},
|
||
'网络上打印机很多时会生成一堆队列，看着乱，这时可以关掉': {'en': 'On networks with many printers it spawns a pile of queues; turn it off in that case.'},
|
||
'默认关闭 —— 管理操作还是在本机做更安全': {'en': 'Off by default - administration is safer done on this host.'},
|
||
},
|
||
'PRINT_ITEMS': {
|
||
'browsed': {'name': 'cups-browsed auto discovery', 'why': 'Searches the LAN for network printers and creates a local queue for each. That is how your HP OfficeJet Pro 7740 was found.'},
|
||
'listen': {'name': 'Allow LAN access', 'why': 'Out of the box CUPS only listens on 127.0.0.1:631, meaning only the machine itself can connect and nothing on the LAN can. This is the most common reason for "CUPS is installed but unusable".'},
|
||
'mode': {'name': 'Working mode (pick one)', 'why': 'Decides how this router provides printing. Switching modes stops the other one automatically so both do not fight over the same USB printer.'},
|
||
'remote_admin': {'name': 'Allow remote administration', 'why': 'Lets other machines on the LAN add or remove queues and change settings through CUPS.'},
|
||
'share': {'name': 'Share the printer', 'why': 'Decides whether the queue is published to the network. Without sharing, only this machine can use the queue and other devices cannot even see it.'},
|
||
'web_iface': {'name': 'CUPS web interface', 'why': 'CUPS\'s built-in web pages: manage queues, view jobs and change settings.'},
|
||
},
|
||
'QOS_CAKE_MODES': {
|
||
'besteffort': {'name': 'besteffort (no priority)', 'why': 'Priority tiering is off: all traffic shares one queue, made fair by CAKE flow isolation (per host / per flow). Lowest CPU cost, but gaming and voice traffic get no priority.'},
|
||
'diffserv3': {'name': 'diffserv3 (three tiers, recommended)', 'why': 'Three DiffServ tiers: Voice (CS7/CS6/EF/VA; 25% bandwidth share, shortened Codel interval), Best Effort (normal traffic, full bandwidth), Bulk (CS1/LE; low priority, only 6.25% bandwidth share — downloads, BitTorrent, video).'},
|
||
'diffserv4': {'name': 'diffserv4 (four tiers)', 'why': 'Adds a Video tier on top of diffserv3 (AF4x/AF3x/CS3/AF2x/CS2; 50% bandwidth share) and covers more DSCP codes for Voice. One more tin costs slightly more CPU.'},
|
||
},
|
||
'QOS_IMPACT': {
|
||
'CAKE 会占用 CPU': {'name': 'CAKE costs CPU', 'why': 'CAKE schedules per packet, so the higher the bandwidth the higher the CPU cost. Up to 1 Gbps is usually fine; above 2 Gbps prefer flowtable or XDP (and on a VM the real ceiling is lower).'},
|
||
'HTB 按 IP 限速影响面': {'name': 'Scope of HTB per-IP limits', 'why': 'A limit applies to both directions of one LAN IP at once. Setting the guaranteed bandwidth too low keeps that device permanently slow, so pair guaranteed with peak bandwidth.'},
|
||
'与 flowtable 软加速冲突': {'name': 'Conflicts with flowtable software acceleration', 'why': 'Software acceleration lets established connections bypass netfilter, which breaks DSCP marking and mark-based classification. Turn off software acceleration in "Network Status / Acceleration" before enabling QoS; this module detects it and warns you.'},
|
||
'加密流量无法识别应用': {'name': 'Encrypted traffic cannot be identified', 'why': 'HTTPS / QUIC are encrypted, so ports and DSCP alone cannot tell you which app it is. Enable the DPI module (nDPI) for per-app rules, at the cost of an extra process and CPU.'},
|
||
'连接数限制的取舍': {'name': 'Trade-off in connection limits', 'why': 'Limiting concurrent connections per IP stops a misbehaving device from overwhelming the router, but too low a value makes legitimate apps such as torrent clients and multi-tab browsers fail. Keep it above 300.'},
|
||
},
|
||
'QOS_PRESETS': {
|
||
'bt': {'name': 'Demote BT / P2P', 'why': 'Drops P2P to the lowest priority so it does not consume bandwidth needed by games and web pages.'},
|
||
'dns': {'name': 'DNS first', 'why': 'Prioritising small DNS packets noticeably improves how fast a page starts loading.'},
|
||
'gaming': {'name': 'Gaming first', 'why': 'Marks the ports Steam / Xbox / PSN commonly use as high priority so they jump the queue.'},
|
||
'video': {'name': 'Video first', 'why': 'Real-time audio/video for video conferencing (Tencent Meeting / Zoom / Teams / WebRTC) and live streaming. af41 sits half a step below gaming and above ordinary web, so the picture stays smooth without squeezing out downloads and games.'},
|
||
'voip': {'name': 'Voice first', 'why': 'SIP and RTP voice traffic get the highest priority, avoiding choppy calls.'},
|
||
},
|
||
'SHARE_DIR_TEMPLATES': {
|
||
'backup': {'name': 'Backup share (writable by designated hosts only)', 'note': 'Combine with an "allowed subnet" restriction so only the backup server can reach it.'},
|
||
'home': {'name': 'Private folder (account required)', 'note': 'Must be accessed with a username and password; only the users you name can get in.'},
|
||
'media': {'name': 'Media library (read-only)', 'note': 'For TV boxes and players; read-only avoids accidentally deleting the source material.'},
|
||
'public': {'name': 'Public share (everyone can read and write)', 'note': 'Good for files shared across the household; on SMB it is written as nobody, on NFS with all_squash.'},
|
||
},
|
||
'SHARE_TEXTS': {
|
||
'Linux': {'d': 'Linux'},
|
||
'NFS 在 Linux 上性能最好，推荐局域网内 Linux 之间使用。': {'d': 'NFS performs best on Linux; recommended between Linux machines on the LAN.'},
|
||
'SMB 面向 Windows / macOS / Linux 全平台，兼容性最好；NFS 更适合 Linux 之间互传，性能更高但 Windows 需要额外客户端。两者可以同时开启，共享同一个目录。': {'d': 'SMB works across Windows / macOS / Linux with the best compatibility; NFS suits Linux-to-Linux transfers better with higher performance but needs an extra client on Windows. Both can be enabled at the same time and share the same folders.'},
|
||
'SMB：安装 cifs-utils 后挂载；NFS：安装 nfs-common 后挂载。': {'d': 'SMB: install cifs-utils then mount; NFS: install nfs-common then mount.'},
|
||
'Windows 10 / 11': {'d': 'Windows 10 / 11'},
|
||
'Windows 需在「启用或关闭 Windows 功能」里勾选「NFS 客户端」才能挂载 NFS。一般用 SMB 即可。': {'d': 'Windows needs the "NFS client" ticked in "Turn Windows features on or off" to mount NFS. SMB is usually enough.'},
|
||
'macOS': {'d': 'macOS'},
|
||
'macOS 自带 NFS v3/v4 客户端；SMB 更推荐，兼容性与权限处理都更好。': {'d': 'macOS ships NFS v3/v4 clients; SMB is still recommended for better compatibility and permission handling.'},
|
||
'右键该共享 →「映射网络驱动器」，即可长期使用。': {'d': 'Right-click the share -> "Map network drive" to keep using it permanently.'},
|
||
'把挂载写进 /etc/fstab 可开机自动挂载。': {'d': 'Write the mount into /etc/fstab to mount automatically at boot.'},
|
||
'若弹出凭据窗口：用户名填 drouter（或你创建的账号），密码为对应密码；公共盘可勾选「使用其他账户」后留空直接确定。': {'d': 'If a credentials prompt appears: enter drouter (or the account you created) as the username and its password; for public shares you can tick "Use another account" and confirm with it left empty.'},
|
||
'访达 → 顶部菜单「前往」→「连接服务器」(⌘K)': {'d': 'Finder -> menu "Go" -> "Connect to Server" (Cmd+K)'},
|
||
},
|
||
'SNAPSHOT_SCOPE': {
|
||
'界面配置（全部模块）': {'group': 'Interface configuration (all modules)'},
|
||
'系统文件': {'group': 'System files'},
|
||
'账号与审计': {'group': 'Accounts and audit'},
|
||
},
|
||
'STORAGE_BUS': {
|
||
'MMC / TF 卡': {'en': 'MMC / TF card'},
|
||
'NVMe': {'en': 'NVMe'},
|
||
'SATA / SCSI': {'en': 'SATA / SCSI'},
|
||
'USB': {'en': 'USB'},
|
||
'未知': {'en': 'unknown'},
|
||
'虚拟磁盘': {'en': 'virtual disk'},
|
||
'雷电 / USB4': {'en': 'Thunderbolt / USB4'},
|
||
},
|
||
'STORAGE_TYPE': {
|
||
'光驱': {'en': 'optical drive'},
|
||
'分区': {'en': 'partition'},
|
||
'整盘': {'en': 'whole disk'},
|
||
},
|
||
'SYSINFO_NOTES': {
|
||
'QEMU / KVM 虚拟机': {'n': 'QEMU / KVM virtual machine'},
|
||
'UEFI': {'d': 'UEFI', 'n': 'UEFI'},
|
||
'传统 BIOS': {'d': 'Legacy BIOS', 'n': 'Legacy BIOS'},
|
||
'宿主机的 CPU 温度传感器通常不随虚拟机暴露。若宿主机为物理机，可在 Proxmox 中把温度相关 PCI 设备（如带温度上报的 BMC/IPMI、或部分 USB HID 传感器）直通给本虚拟机；成功率取决于平台与硬件。': {'d': 'Host CPU temperature sensors are not exposed to the guest', 'n': 'Host temperature sensor unavailable'},
|
||
'当前运行在 QEMU / KVM 虚拟机 中，虚拟化层默认不会把宿主机 CPU 温度传感器暴露给客户机，因此温度无法读取。宿主机的 CPU 温度传感器通常不随虚拟机暴露。若宿主机为物理机，可在 Proxmox 中把温度相关 PCI 设备（如带温度上报的 BMC/IPMI、或部分 USB HID 传感器）直通给本虚拟机；成功率取决于平台与硬件。': {'d': 'This machine runs as a QEMU / KVM guest. The virtualization layer does not expose the host CPU temperature sensor by default, so the reading is unavailable. On a physical host you can pass the relevant PCI device (a BMC/IPMI with temperature reporting, or some USB HID sensors) through to this VM in Proxmox; success depends on the platform and hardware.'},
|
||
'未读取到温度': {'d': 'No temperature reading'},
|
||
'未读取到温度传感器，仅显示进程数': {'d': 'No temperature sensor found; only the process count is shown'},
|
||
},
|
||
'THEME_AUTHOR': {
|
||
'Drouter 内置': {'en': 'Drouter built-in'},
|
||
},
|
||
'THEME_DESC': {
|
||
'dark-green': {'en': 'Dark theme, easier on the eyes at night'},
|
||
'dark-rose': {'en': 'Dark base with crimson accents'},
|
||
'default': {'en': 'Default theme, blue tones, light interface'},
|
||
'electric-blue': {'en': 'High-saturation cyan-blue with a glow, good for status lights and charts'},
|
||
'navy': {'en': 'Deep near-black blue with low glare, for night use and long shifts'},
|
||
'teal': {'en': 'Fresh teal, comfortable for long sessions'},
|
||
'violet': {'en': 'High-contrast purple'},
|
||
'warm': {'en': 'Warm orange tones, bright and lively'},
|
||
},
|
||
'THEME_NAMES': {
|
||
'dark-green': {'desc': 'A dark theme, gentler on the eyes at night', 'name': 'Dark Green'},
|
||
'dark-rose': {'desc': 'Dark with rose-red accents', 'name': 'Dark Rose'},
|
||
'default': {'desc': 'The default theme — a blue, light interface', 'name': 'Drouter Classic Blue'},
|
||
'electric-blue': {'desc': 'A high-saturation cyan-blue with a glowing feel; good for status lights and charts', 'name': 'Electric Blue'},
|
||
'navy': {'desc': 'Deep blue, near-black; low-glare and easy on the eyes for night and long shifts', 'name': 'Navy'},
|
||
'teal': {'desc': 'A fresh teal-green, easy on the eyes for long sessions', 'name': 'Teal'},
|
||
'violet': {'desc': 'A high-contrast purple tone', 'name': 'Violet'},
|
||
'warm': {'desc': 'A warm orange tone — bright and lively', 'name': 'Warm Sun'},
|
||
},
|
||
'ULOG_SOURCES': {
|
||
'app': {'desc': 'drouter’s own operations and error records', 'n': 'Application log'},
|
||
'conntrack': {'desc': 'NAT connection create / destroy / update events', 'n': 'Connection tracking'},
|
||
'ddns': {'desc': 'DDNS update results and public address changes', 'n': 'Dynamic DNS'},
|
||
'flow': {'desc': 'A live snapshot of the connection table (conntrack -L)', 'n': 'Current connections'},
|
||
'fw': {'desc': 'Packets accepted or dropped by nftables (log statements)', 'n': 'Firewall'},
|
||
'system': {'desc': 'Kernel and system service journal entries', 'n': 'System log'},
|
||
'wan': {'desc': 'Link-up events: dial-up, DHCP, static addressing and so on', 'n': 'WAN uplink'},
|
||
},
|
||
'UPS_PROTO': {
|
||
'DHCP 自动': {'en': 'DHCP (automatic)'},
|
||
'DHCPv6 客户端': {'en': 'DHCPv6 client'},
|
||
'PPPoE 拨号': {'en': 'PPPoE dial-up'},
|
||
'静态地址': {'en': 'Static address'},
|
||
},
|
||
'VLAN_PRESETS': {
|
||
'中国广电 IPTV': {'n': 'China Broadcasting IPTV'},
|
||
'中国电信 IPTV': {'n': 'China Telecom IPTV'},
|
||
'中国移动 IPTV': {'n': 'China Mobile IPTV'},
|
||
'中国联通 IPTV': {'n': 'China Unicom IPTV'},
|
||
'通用 VLAN': {'n': 'Generic VLAN'},
|
||
},
|
||
'WAN_ACCESS_TYPES': {
|
||
'bridge': {'desc': 'Layer-2 passthrough / bypass only; no dial-up here, and the WAN state is determined by the upstream device', 'n': 'Bridge / bypass (WAN untouched)'},
|
||
'dhcp': {'desc': 'The ONT already dialled and downstream devices get their addresses automatically; also used for "IPoE, no dial-up" access in some regions', 'n': 'DHCP (IPoE)'},
|
||
'ipoe_dhcp6': {'desc': 'Both IPv4 and IPv6 are handed down by the upstream device; suits an ONT in routing mode plus direct IPv6', 'n': 'IPoE + DHCPv6-PD (dual stack)'},
|
||
'pppoe': {'desc': 'ONT in bridge mode + the host or router dials out; needs your broadband account and password (common with China Telecom / Unicom / Mobile / CBN)', 'n': 'PPPoE dial-up'},
|
||
'pppoe_dhcp6': {'desc': 'IPv4 over PPPoE, IPv6 prefix delegated via DHCPv6-PD — the mainstream dual-stack setup in China', 'n': 'PPPoE + DHCPv6-PD (dual stack)'},
|
||
'static': {'desc': 'The ISP assigns a fixed public IP; configure the address, gateway and DNS yourself', 'n': 'Static address (leased line / fixed IP)'},
|
||
},
|
||
'WAN_LOG_SOURCE': {
|
||
'dhclient / NetworkManager 租约协商日志 + 内核地址事件': {'en': 'dhclient / NetworkManager lease negotiation log + kernel address events'},
|
||
'dhclient（v4/v6）日志 + 内核 IPv6 路由器通告事件': {'en': 'dhclient (v4/v6) log + kernel IPv6 router advertisement events'},
|
||
'pppd 拨号日志 + 内核 IPv6 地址/前缀事件（DHCPv6-PD）': {'en': 'pppd dial log + kernel IPv6 address/prefix events (DHCPv6-PD)'},
|
||
'pppd 拨号进程日志（journalctl -u pppd-drouter）+ 内核 ppp 链路事件': {'en': 'pppd dial process log (journalctl -u pppd-drouter) + kernel PPP link events'},
|
||
'内核地址与路由事件（netlink）+ 网关可达性探测': {'en': 'Kernel address/route events (netlink) + gateway reachability probes'},
|
||
'内核网桥/链路事件（netlink）': {'en': 'Kernel bridge/link events (netlink)'},
|
||
},
|
||
'WAN_STATE': {
|
||
'已获取地址（DHCP 协商完成）': {'en': 'Address obtained (DHCP negotiation complete)'},
|
||
'已连接': {'en': 'Connected'},
|
||
'已连接（PPPoE 拨号成功）': {'en': 'Connected (PPPoE dial-up succeeded)'},
|
||
'未启用': {'en': 'Not enabled'},
|
||
'未拨号': {'en': 'Not dialled'},
|
||
'未拨号（拨号进程未运行）': {'en': 'Not dialled (dial-up process not running)'},
|
||
'未知状态': {'en': 'Unknown state'},
|
||
'未连接（WAN 网卡不存在或未分配）': {'en': 'Disconnected (WAN NIC missing or unassigned)'},
|
||
'网桥已工作（透传模式）': {'en': 'Bridge working (passthrough mode)'},
|
||
'连接中…': {'en': 'Connecting…'},
|
||
'连接中…（会话已建立，等待认证）': {'en': 'Connecting… (session established, awaiting authentication)'},
|
||
'连接中…（正在与接入服务器协商）': {'en': 'Connecting… (negotiating with the access server)'},
|
||
'连接中…（等待 DHCP 分配地址）': {'en': 'Connecting… (waiting for DHCP to assign an address)'},
|
||
'重拨中…': {'en': 'Redialing…'},
|
||
'链路已就绪（静态配置生效）': {'en': 'Link ready (static configuration active)'},
|
||
'链路已配置但未连通（检查网线与上级端口）': {'en': 'Link configured but not connected (check cable and upstream port)'},
|
||
},
|
||
'WIZ_DNS_PRESETS': {
|
||
'114': {'d': 'A carrier-grade public resolver: stable, but latency can be mediocre in some regions.', 'n': '114DNS'},
|
||
'ali': {'d': 'The fastest and widest-reaching resolver inside China; the usual choice for home broadband.', 'n': 'Alibaba Cloud AliDNS'},
|
||
'cf': {'d': 'An overseas resolver. Direct latency from China is high, which can make domestic sites slower.', 'n': 'Cloudflare'},
|
||
'dnspod': {'d': 'A long-standing Chinese resolver that is fairly aggressive about blocking malicious domains.', 'n': 'Tencent DNSPod'},
|
||
'gg': {'d': 'An overseas resolver. Often blocked or interfered with in China, so rarely the first choice.', 'n': 'Google Public DNS'},
|
||
'isp': {'d': 'Use the DNS your ISP hands out during PPPoE dial-up. Least effort, but it can be hijacked to inject ads.', 'n': 'Follow the ISP assignment'},
|
||
},
|
||
'WIZ_STEPS': {
|
||
'dns': {'d': 'Domain names have to be translated into IPs before they can be reached. This step decides between the ISP’s DNS and a public one.', 'n': 'Step 3 · Open websites'},
|
||
'lan': {'d': 'Let phones and computers get an IP automatically over Ethernet or Wi-Fi, with no manual configuration.', 'n': 'Step 2 · Hand out addresses on the LAN'},
|
||
'v6': {'d': 'IPv6 is the next generation of addressing. Chinese broadband mostly supports it now, and leaving it on is usually right.', 'n': 'Step 4 · Decide on IPv6'},
|
||
'wan': {'d': 'Tell this machine where the broadband line comes in, and confirm it really connects.', 'n': 'Step 1 · Connect to the internet'},
|
||
},
|
||
'WIZ_WAN_MODES': {
|
||
'dhcp': {'d': 'Plug in the cable and you have an address; no account or password needed.', 'n': 'DHCP automatic (IPoE)', 'when': 'The ONT is already dialled and this host sits behind it; or estate broadband / a line with IPoE enabled.'},
|
||
'pppoe': {'d': 'Needs your broadband account and password, and this host dials out. This is what most China Telecom / Unicom / Mobile / CBN home lines use.', 'n': 'PPPoE dial-up', 'when': 'The ONT is set to bridge mode, or you intend this host to take over dialling from the ISP ONT.'},
|
||
'static': {'d': 'The ISP gave you a fixed IP, gateway and DNS; fill them in by hand.', 'n': 'Static address', 'when': 'Enterprise leased lines or fixed-IP broadband. Very rare at home.'},
|
||
},
|
||
'WOL_REASON': {
|
||
'网卡不支持 WOL': {'d': 'This NIC does not support WOL'},
|
||
'该网卡或驱动未上报 WOL 能力': {'d': 'This NIC or its driver does not report WOL capability'},
|
||
},
|
||
# 更新模块（backend/drouter-update.py）：PROBES/DL_SOURCES 的源名、ASSETS 的说明。
|
||
# 前端 update.js 走 bt4 查英文（不再把中文键写在 update.js 里，避免被
|
||
# t-i18n-cover 判成「未包 t() 的文案」）。
|
||
'UPD_SOURCES': {
|
||
'GitHub 官方': {'en': 'GitHub (official)'},
|
||
'ghproxy 镜像': {'en': 'ghproxy mirror'},
|
||
'kkgithub 镜像': {'en': 'kkgithub mirror'},
|
||
},
|
||
'UPD_ASSETS': {
|
||
'deb': {'d': 'Deb package (recommended, 523 KB)'},
|
||
'offline': {'d': 'Offline bundle (87 MB, installs without Internet)'},
|
||
'docker': {'d': 'Docker image (169 MB)'},
|
||
},
|
||
|
||
}
|